{
  "schema_version": "forge.evidence-research-sources/v1",
  "cut_at": "2026-07-17T23:24:33Z",
  "issue": "https://github.com/needyuai/trustyu-docs/issues/292",
  "executor": {
    "repository": "https://github.com/needyuai/trustyu-ai-env",
    "pull_request": "https://github.com/needyuai/trustyu-ai-env/pull/63",
    "merge_commit": "fb43ea3d722399de7c2f3285d070f2e14b8c7674",
    "policy_id": "forge.public-evidence-fetch/v1"
  },
  "policy": {
    "minimum_sources": 20,
    "minimum_independence_groups": 8,
    "retrieved_at": "2026-07-17T23:05:13Z",
    "max_bytes": 2000000,
    "timeout_seconds": 30,
    "max_redirects": 2,
    "retention": {
      "derived_days": 365,
      "disposition": "archive-public-derived"
    },
    "budget": {
      "max_model_tokens": 0,
      "max_cost_usd": 0,
      "stop_on_limit": true
    },
    "reviewed_by": "codex-SQ117"
  },
  "sources": [
    {
      "id": "OPENAI-SYMPHONY-SPEC",
      "title": "Symphony specification",
      "publisher": "OpenAI",
      "independence_group": "openai",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["harness", "orchestration", "workspace", "observability"],
      "url": "https://raw.githubusercontent.com/openai/symphony/45a53b8588a9650c2f424cb31a6495af1bc86727/SPEC.md",
      "snapshot_ref": "git:45a53b8588a9650c2f424cb31a6495af1bc86727:SPEC.md",
      "content_sha256": "sha256:fa9d7c252cc72d10afdaf4e46e0d890aae28cf4331dc531c94413bc8ea199452",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "Apache-2.0 repository; analysis-only excerpts"
    },
    {
      "id": "OPENAI-CODEX-SANDBOX",
      "title": "Codex Linux sandbox",
      "publisher": "OpenAI",
      "independence_group": "openai",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["sandbox", "least-privilege", "security"],
      "url": "https://raw.githubusercontent.com/openai/codex/3a067484584861606ad842de5bc4ac735a865ddf/codex-rs/linux-sandbox/README.md",
      "snapshot_ref": "git:3a067484584861606ad842de5bc4ac735a865ddf:codex-rs/linux-sandbox/README.md",
      "content_sha256": "sha256:6aded54850dbd728ac2eb9e8ebdcf82c5ff794f5dfbef8aab711b6eb650cb007",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "Apache-2.0 repository; analysis-only excerpts"
    },
    {
      "id": "OPENAI-AGENTS-TRACING",
      "title": "OpenAI Agents SDK tracing",
      "publisher": "OpenAI",
      "independence_group": "openai",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["agents", "tracing", "observability", "privacy"],
      "url": "https://raw.githubusercontent.com/openai/openai-agents-python/15bac19550b65ffb049a9aef62f50b872abff719/docs/tracing.md",
      "snapshot_ref": "git:15bac19550b65ffb049a9aef62f50b872abff719:docs/tracing.md",
      "content_sha256": "sha256:9ecbbc45c18287059b644eb8ebd86750234efaff272ffd110442b0898b0ca881",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "MIT repository; analysis-only excerpts"
    },
    {
      "id": "DORA-2025",
      "title": "DORA report 2025",
      "publisher": "Google Cloud DORA",
      "independence_group": "google-dora",
      "quality_tier": "empirical-primary",
      "recency": "edition-2025",
      "topics": ["ai-capabilities", "delivery", "organizational-system"],
      "url": "https://dora.dev/research/2025/dora-report/",
      "snapshot_ref": "retrieved:2026-07-17",
      "content_sha256": "sha256:6bb53c243fc615849727e65b6a9aa33dbd6b0d5c4e63af5ce68137db0924b4d9",
      "mime_type": "text/html",
      "allowed_hosts": ["dora.dev"],
      "usage_basis": "Public research page; analysis-only excerpts"
    },
    {
      "id": "NIST-DIOPTRA-AI-RMF",
      "title": "NIST Dioptra implementation of AI RMF Measure",
      "publisher": "NIST",
      "independence_group": "nist",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["ai-risk", "measurement", "experimentation"],
      "url": "https://raw.githubusercontent.com/usnistgov/dioptra/796a79016b417a9e0fd3e5641c0164a42c3e5d79/README.md",
      "snapshot_ref": "git:796a79016b417a9e0fd3e5641c0164a42c3e5d79:README.md",
      "content_sha256": "sha256:b0b94e138ea9dfcfd1b3a1bd9e7a7f50d2c906715d9907f76b2a55f783c8d1a8",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "NIST public-domain repository; analysis-only excerpts"
    },
    {
      "id": "SLSA-1.2",
      "title": "SLSA specification 1.2",
      "publisher": "OpenSSF SLSA",
      "independence_group": "slsa-openssf",
      "quality_tier": "normative",
      "recency": "version-1.2",
      "topics": ["supply-chain", "provenance", "attestation"],
      "url": "https://slsa.dev/spec/v1.2/",
      "snapshot_ref": "version:1.2",
      "content_sha256": "sha256:46edf628a901c268261cf8b72a1b478926ae9b2db050fa21194c914e7417e3ae",
      "mime_type": "text/html",
      "allowed_hosts": ["slsa.dev"],
      "usage_basis": "CC-BY-4.0 specification; analysis-only excerpts"
    },
    {
      "id": "GITHUB-ATTESTATIONS",
      "title": "GitHub artifact attestations",
      "publisher": "GitHub",
      "independence_group": "github",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["attestation", "provenance", "supply-chain"],
      "url": "https://raw.githubusercontent.com/github/docs/d44cdb15335bb00c7784e61229ec4e85fa250d70/content/actions/concepts/security/artifact-attestations.md",
      "snapshot_ref": "git:d44cdb15335bb00c7784e61229ec4e85fa250d70:content/actions/concepts/security/artifact-attestations.md",
      "content_sha256": "sha256:664b528c604fb5b1cd0100b7dc5f785ccbef5091421840b460cd2a750d02f4dd",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-4.0 documentation; analysis-only excerpts"
    },
    {
      "id": "FINOPS-UNIT-COST",
      "title": "FinOps capability: measure unit costs",
      "publisher": "FinOps Foundation",
      "independence_group": "finops-foundation",
      "quality_tier": "normative",
      "recency": "pinned-current",
      "topics": ["finops", "unit-economics", "cost"],
      "url": "https://raw.githubusercontent.com/finopsfoundation/framework/cf31432a637548c85434270dfd9323cc69383326/_capabilities/measure-unit-costs.md",
      "snapshot_ref": "git:cf31432a637548c85434270dfd9323cc69383326:_capabilities/measure-unit-costs.md",
      "content_sha256": "sha256:1bb62e03cc2b6d47da661fe34b1df07559be9641c500188fce7c8b3c029369ea",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-4.0 framework; analysis-only excerpts"
    },
    {
      "id": "GITHUB-BILLING-USAGE-API",
      "title": "GitHub REST billing usage reports",
      "publisher": "GitHub",
      "independence_group": "github",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["billing", "usage", "api", "cost"],
      "url": "https://raw.githubusercontent.com/github/docs/d44cdb15335bb00c7784e61229ec4e85fa250d70/content/rest/billing/usage-reports.md",
      "snapshot_ref": "git:d44cdb15335bb00c7784e61229ec4e85fa250d70:content/rest/billing/usage-reports.md",
      "content_sha256": "sha256:a833258b845640cca73b6815f75fbf729ac0fb4625bdbc306db6de8f9b63dfbe",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-4.0 documentation; analysis-only excerpts"
    },
    {
      "id": "AWS-ADR",
      "title": "AWS architecture decision record process",
      "publisher": "Amazon Web Services",
      "independence_group": "aws",
      "quality_tier": "official-primary",
      "recency": "current-guidance",
      "topics": ["adr", "decision", "governance"],
      "url": "https://docs.aws.amazon.com/prescriptive-guidance/latest/architectural-decision-records/adr-process.html",
      "snapshot_ref": "retrieved:2026-07-17",
      "content_sha256": "sha256:816c2d64444ca593aa2e482dd2c198cb09b716c687fc119f5889a1024b346eb5",
      "mime_type": "text/html",
      "allowed_hosts": ["docs.aws.amazon.com"],
      "usage_basis": "Public official guidance; analysis-only excerpts"
    },
    {
      "id": "AZURE-ADR",
      "title": "Azure architecture decision records",
      "publisher": "Microsoft Azure",
      "independence_group": "microsoft",
      "quality_tier": "official-primary",
      "recency": "current-guidance",
      "topics": ["adr", "decision", "governance"],
      "url": "https://learn.microsoft.com/azure/well-architected/architect-role/architecture-decision-record",
      "snapshot_ref": "retrieved:2026-07-17",
      "content_sha256": "sha256:36ad3b6a657fec6261a07a372e9832921f2ae3591a825f787fdb4d866b7e4a3a",
      "mime_type": "text/html",
      "allowed_hosts": ["learn.microsoft.com"],
      "usage_basis": "Public official guidance; analysis-only excerpts"
    },
    {
      "id": "GOOGLE-SMALL-CLS",
      "title": "Google engineering practices: small CLs",
      "publisher": "Google",
      "independence_group": "google-dora",
      "quality_tier": "official-primary",
      "recency": "durable-guidance",
      "topics": ["change-size", "review", "delivery"],
      "url": "https://google.github.io/eng-practices/review/developer/small-cls.html",
      "snapshot_ref": "retrieved:2026-07-17",
      "content_sha256": "sha256:0637b70bbb8235a8a3dfe86041e206bd91db35b4b8a4c34cb938f4d8fd6bf5c3",
      "mime_type": "text/html",
      "allowed_hosts": ["google.github.io"],
      "usage_basis": "CC-BY-3.0 guidance; analysis-only excerpts"
    },
    {
      "id": "OPENAI-COST-API",
      "title": "OpenAI organization usage costs API",
      "publisher": "OpenAI",
      "independence_group": "openai",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["provider-billing", "cost", "api"],
      "url": "https://raw.githubusercontent.com/openai/openai-python/d4dceb221b9a92c55c232d5b330ae89beb539415/api.md",
      "snapshot_ref": "git:d4dceb221b9a92c55c232d5b330ae89beb539415:api.md",
      "content_sha256": "sha256:6127f53d7b46331c268258b5d551a5797c2f5c7e05c1b833f0d2d8494c42b850",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "Apache-2.0 SDK documentation; analysis-only excerpts"
    },
    {
      "id": "GOOGLE-CLOUD-BILLING-EXPORT",
      "title": "Google Cloud billing export and dashboard",
      "publisher": "Google Cloud",
      "independence_group": "google-dora",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["provider-billing", "cloud-billing", "cost-export"],
      "url": "https://raw.githubusercontent.com/GoogleCloudPlatform/terraform-google-billing-dashboard/4872a84a174f153947571da8c6e3b6ec64e9216b/README.md",
      "snapshot_ref": "git:4872a84a174f153947571da8c6e3b6ec64e9216b:README.md",
      "content_sha256": "sha256:561f0a275d819336070dc9b3754ba0c6a56c446b7909e9329f275a637466a933",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "Apache-2.0 official Google Cloud blueprint; analysis-only excerpts"
    },
    {
      "id": "OWASP-AISVS",
      "title": "OWASP AI Security Verification Standard",
      "publisher": "OWASP Foundation",
      "independence_group": "owasp",
      "quality_tier": "normative",
      "recency": "pinned-current",
      "topics": ["agentic-security", "verification", "least-privilege"],
      "url": "https://raw.githubusercontent.com/OWASP/AISVS/94fbad5acee4e4716bff263a4c455dfd780e53a7/README.md",
      "snapshot_ref": "git:94fbad5acee4e4716bff263a4c455dfd780e53a7:README.md",
      "content_sha256": "sha256:06e2554534e48a938bd440e805524633cad0f4dbcf427ee94790d7534a19bec2",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-SA-4.0 standard; analysis-only excerpts"
    },
    {
      "id": "ANTHROPIC-EVAL-COOKBOOK",
      "title": "Anthropic cookbook summarization evaluation",
      "publisher": "Anthropic",
      "independence_group": "anthropic",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["evals", "groundedness", "quality"],
      "url": "https://raw.githubusercontent.com/anthropics/anthropic-cookbook/67ce644d33e5933f0bcc0b6eb4113df41bbf3a8f/capabilities/summarization/evaluation/README.md",
      "snapshot_ref": "git:67ce644d33e5933f0bcc0b6eb4113df41bbf3a8f:capabilities/summarization/evaluation/README.md",
      "content_sha256": "sha256:c7eceba55eecd935e77971f6467158913f49277ff0d22cfcf96318b1778f420a",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "MIT repository; analysis-only excerpts"
    },
    {
      "id": "AUTOGEN-AGENTCHAT",
      "title": "Microsoft AutoGen AgentChat",
      "publisher": "Microsoft",
      "independence_group": "microsoft",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["multi-agent", "orchestration", "teams"],
      "url": "https://raw.githubusercontent.com/microsoft/autogen/027ecf0a379bcc1d09956d46d12d44a3ad9cee14/python/README.md",
      "snapshot_ref": "git:027ecf0a379bcc1d09956d46d12d44a3ad9cee14:python/README.md",
      "content_sha256": "sha256:098c8467e3b9a28e506e87bd78eb0078bb1205175b4e375bf8e5f525cd759e08",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "MIT/CC-BY-4.0 repository; analysis-only excerpts"
    },
    {
      "id": "OTEL-GENAI-OBSERVABILITY",
      "title": "OpenTelemetry GenAI observability",
      "publisher": "OpenTelemetry",
      "independence_group": "opentelemetry",
      "quality_tier": "official-primary",
      "recency": "pinned-2026",
      "topics": ["genai", "observability", "traces", "metrics", "cost"],
      "url": "https://raw.githubusercontent.com/open-telemetry/opentelemetry.io/30b7dbbdd94cec0b2a0c99317272b103315518bf/content/en/blog/2026/genai-observability/index.md",
      "snapshot_ref": "git:30b7dbbdd94cec0b2a0c99317272b103315518bf:content/en/blog/2026/genai-observability/index.md",
      "content_sha256": "sha256:10ad1d4dbafccad8b17af5dbf21ca7df2c04ee274832b4b44b52418fb5210ffa",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-4.0 documentation; analysis-only excerpts"
    },
    {
      "id": "GITHUB-BILLING-REPORTS",
      "title": "GitHub billing reports",
      "publisher": "GitHub",
      "independence_group": "github",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["billing", "reconciliation", "usage", "cost"],
      "url": "https://raw.githubusercontent.com/github/docs/d44cdb15335bb00c7784e61229ec4e85fa250d70/content/billing/reference/billing-reports.md",
      "snapshot_ref": "git:d44cdb15335bb00c7784e61229ec4e85fa250d70:content/billing/reference/billing-reports.md",
      "content_sha256": "sha256:a7e48d12a7ccda41f89b4a547144cf09a09fe0cca0ebdbe67382139da0d2a877",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "CC-BY-4.0 documentation; analysis-only excerpts"
    },
    {
      "id": "ANTHROPIC-USAGE-COST-API",
      "title": "Anthropic Usage and Cost API cookbook",
      "publisher": "Anthropic",
      "independence_group": "anthropic",
      "quality_tier": "official-primary",
      "recency": "pinned-current",
      "topics": ["provider-billing", "usage", "cost", "api"],
      "url": "https://raw.githubusercontent.com/anthropics/claude-cookbooks/67ce644d33e5933f0bcc0b6eb4113df41bbf3a8f/observability/usage_cost_api.ipynb",
      "snapshot_ref": "git:67ce644d33e5933f0bcc0b6eb4113df41bbf3a8f:observability/usage_cost_api.ipynb",
      "content_sha256": "sha256:f7bcef066921a3c49501dfccc2706869c6f17b56a924ab2e49e78de40a2bdc30",
      "mime_type": "text/plain",
      "allowed_hosts": ["raw.githubusercontent.com"],
      "usage_basis": "MIT repository; analysis-only excerpts"
    }
  ]
}